An improper neutralization of input occurs in Drupal USWDS Paragraph Components, permitting attackers to store malicious script inside a paragraph field. When the page is rendered, the injected script runs in the victim’s browser, enabling theft of credentials, session hijacking or other client‑side attacks. The flaw requires that an attacker can submit or modify paragraph content, but does not require a system‑wide compromise.

Drupal sites that install the USWDS Paragraph Components module for any version from 0.0.0 through 3.1.3 are impacted. Site administrators who allow content editors to create or edit paragraph components are at risk, regardless of the Drupal core version.

The CVSS score is not publicly disclosed, and the EPSS score is unavailable, but the vulnerability is listed as a stored XSS (CWE‑79). Because stored XSS attacks can be launched by any user who submits content via the web interface, the likelihood of exploitation is high in environments where unrestricted paragraph input is permitted. No known exploit code is listed in the CISA KEV registry, though the absence of a KEV listing does not reduce the risk of an attacker taking advantage of this flaw.